Skip to content
Threat Feed
Subscribe

Tag

Wbadmin

2 briefs RSS
high advisory

Detection of Ransomware Backup Deletion via WBAdmin

Attackers utilize the native Windows utility wbadmin.exe to delete system backups and catalogs as part of ransomware operations to impede victim recovery.

Windows ransomware impact wbadmin
1r 1t
medium advisory

NTDS Dump via Wbadmin

Attackers with Backup Operator privileges may abuse wbadmin.exe to access the NTDS.dit file, enabling credential dumping and domain compromise.

Microsoft Defender XDR +4 credential-access windows wbadmin ntds.dit
2r 2t